DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

Extortion by fired IT workers threatening to release former employers’ data

Date (as written)
since late October 2024
Year
2024
Actors (as written)
DPRK IT workers (per Mandiant)
Actor pages
DPRK IT workers
Tags (as written)
IT workers; extortion

Source entries (1)

Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025

Extortion by fired IT workers threatening to release former employers’ data · since late October 2024
(MSMT/2025/2, report p. 54-55) “Based on data from multiple sources, Mandiant assesses that since late October 2024, IT workers have increased the volume of extortion attempts and gone after larger organizations. In these incidents, recently fired IT workers threatened to release their former employers’ sensitive data or to provide it to a competitor. This data included proprietary data and source code for internal projects.”
https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/pdfs/2025-10-22_MSMT-Report.pdf

Suggest a correction on GitHub